RACF: A Resilient Autonomous Car Framework with Object Distance Correction

Chieh Tsai; Hossein Rastgoftar; Salim Hariri

cs.ROApr 14, 2026

RACF: A Resilient Autonomous Car Framework with Object Distance Correction

Authors: Chieh Tsai, Hossein Rastgoftar, Salim Hariri

Organizations: Department of Electrical and Computer Engineering, University of Arizona, Tucson, AZ, USA · Department of Aerospace and Mechanical Engineering, University of Arizona, Tucson, AZ, USA

Abstract

Autonomous vehicles are increasingly deployed in safety-critical applications, where sensing failures or cyberphysical attacks can lead to unsafe operations resulting in human loss and/or severe physical damages. Reliable real-time perception is therefore critically important for their safe operations and acceptability. For example, vision-based distance estimation is vulnerable to environmental degradation and adversarial perturbations, and existing defenses are often reactive and too slow to promptly mitigate their impacts on safe operations. We present a Resilient Autonomous Car Framework (RACF) that incorporates an Object Distance Correction Algorithm (ODCA) to improve perception-layer robustness through redundancy and diversity across a depth camera, LiDAR, and physics-based kinematics. Within this framework, when obstacle distance estimation produced by depth camera is inconsistent, a cross-sensor gate activates the correction algorithm to fix the detected inconsistency. We have experiment with the proposed resilient car framework and evaluate its performance on a testbed implemented using the Quanser QCar 2 platform. The presented framework achieved up to 35% RMSE reduction under strong corruption and improves stop compliance and braking latency, while operating in real time. These results demonstrate a practical and lightweight approach to resilient perception for safety-critical autonomous driving

Figures & tables

Fig. 1 : Resilient Car Framework Testbed. Top: QCar testbed scenario under visual corrup-tion, where attacked depth becomes inconsistent with LiDAR and leads to unsafe distance estimation. Bottom: Distance predictions for (a) no defense, (b) full replacement using Chronos [ 4 ] , and (c) the proposed framework ability to be resilient and robust againt distance sensor attacks.

Fig. 2 : Perception-layer realization of ODCA within RACF. ChronosV2 provides uncertainty-aware temporal features. A lightweight delta head predicts additive depth corrections. A LiDAR-based consistency gate controls fusion, producing a conservative control-ready distance output.

$T_{\text{atk}}$ (s)	Lost-Detection Frames	ASR $\uparrow$
0.5	7–8	0.50
1.0	15–16	0.90
3.0	48–58	1.00

TABLE I : Attack persistence analysis under varying patch durations (no defense).

Panel of Figure 4 — Fig. 3 : Attack scenarios used in evaluation. (a) Controlled offline corruption applied to depth/confidence signals. (b) Physical adversarial patch deployed during live operation, suppressing stop-sign detection and inducing distance dropout.

Fig. 4 : Strong-strength attack comparison. Left: Chronos [ 4 ] . Right: ODCA (Ours). Black: clean-depth reference (pseudo-ground truth); gray dashed: attacked input. ODCA preserves nominal segments and selectively corrects corrupted intervals.

	Attack Strength
Model	Weak		Mid		Strong
	RMSE	MAE	RMSE	MAE	RMSE	MAE
ODCA (Ours)	0.111	0.093	0.193	0.170	0.323	0.283
Chronos [ 4 ]	0.229	0.151	0.363	0.256	0.503	0.353
SOFTS [ 13 ]	0.207	0.171	0.330	0.232	0.649	0.487
NHITS [ 17 ]	0.144	0.104	0.300	0.214	0.498	0.365

TABLE II : Distance estimation accuracy under different attack strengths. Lower RMSE / MAE indicate better perception recovery (

\downarrow

Fig. 5 : Resilience summary across attack strengths (higher is better). Radar axes aggregate RMSE-based robustness at weak/mid/strong, bounded degradation (BD), and average gain vs. Chronos (RGR).

Fig. 6 : Attack-related diagnostic quality ( $\uparrow$ better). Heatmap visualization of AUROC and AUPRC across weak, mid, and strong attack regimes. Cross-sensor residual (XS) and correction magnitude (Chg) are reported for each method. Exact numerical values are overlaid for clarity.

Fig. 7 : Model complexity vs. repair accuracy (Strong). Chronos is frozen; ODCA adds 921 trainable parameters.

Method	RMSE $\downarrow$
LiDAR measurement	0.600
EKF fusion [ 19 ]	0.450
Chronos forecast [ 4 ]	0.503
ODCA (Ours)	0.323

TABLE III : Comparison with representative sensor-level baselines under strong attacks.

Fig. 8 : High-risk stop-sign scenarios on the indoor map. The ego vehicle (blue arrow) encounters cross-traffic from other vehicles (red arrow) at conflict-prone intersections. The stop sign is placed in these regions to evaluate braking safety under attack.

Setting	SCR $\uparrow$	ASR $\downarrow$	$\Delta t_{\text{brake}}$ (s) $\downarrow$
Clean (no attack)	1.00 (30/30)	0.00 (0/30)	$0.1647\pm 0.0160$
Attack (patch [ 16 ] , no defense)	0.17 (5/30)	0.83 (25/30)	$2.65\pm 0.21$
Attack + ODCA (patch [ 16 ] )	0.80 (24/30)	0.20 (6/30)	$0.1900\pm 0.0300$

TABLE IV : Closed-loop stop-sign trials on QCar 2 (real-world),

N=30

per setting. SCR and ASR are trial-level rates;

\Delta t_{\text{brake}}

is computed over successful stops only.

Training Objective	RMSE ${}_{\text{rep}}\downarrow$	$\Delta$ RMSE	AUROC ${}_{\text{chg}}\uparrow$
$\mathcal{L}_{\mathrm{ID}}$	0.588	–	0.425
$\mathcal{L}_{\mathrm{ID}}+\mathcal{L}_{\Delta 0}$	0.393	-0.195	0.609
$\mathcal{L}_{\mathrm{ID}}+\mathcal{L}_{\Delta 0}+\mathcal{L}_{\mathrm{cons}}$	0.366	-0.222	0.648
$\mathcal{L}_{\mathrm{ID}}+\mathcal{L}_{\Delta 0}+\mathcal{L}_{\mathrm{kin}}$	0.374	-0.214	0.593
$\mathcal{L}_{\mathrm{ID}}+\mathcal{L}_{\Delta 0}+\mathcal{L}_{\mathrm{cons}}+\mathcal{L}_{\mathrm{kin}}$ (Full)	0.362	-0.226	0.576

TABLE V : Ablation under Strong attacks. Lower RMSE is better (

\downarrow

); higher AUROC is better (

\uparrow

). Full objective achieves the best recovery while maintaining diagnostic interpretability.

Autonomous Driving

Autonomous driving develops vehicles that perceive road scenes, predict interactions, and plan and control safe movement with limited or no human input.

See all 536 papers

Adversarial Robustness of Camera-Radar Sensor Fusion for Autonomous Driving
Oct 12, 2026Ce Zhou, Yubo Wu, Khang Nguyen +3Camera-Radar Fusion Adversarial Robustness
Missouri University of Science and Technology, USA · Virginia Tech, USA · Michigan State University, USA
A Reliable Context-Aware and Temporal Planning Framework for Autonomous Driving
Jul 6, 2026Argho Dey, Yunfei Yin, Swachha Ray +5End-to-End Autonomous Driving Autonomous Driving Perception
College of Computer Science, Chongqing University, Chongqing 400044, China
Provisioning Robust and Efficient LiDAR Perception for Autonomous Driving
Oct 20, 2026Tingxu Han, Zijie Shen, An Guo +4Lidar-Based 3D Object Detection Autonomous Driving Perception
State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing 210093, China. · Department of Computing, Hong Kong Polytechnic University, Hong Kong SAR, China · School of Science and Engineering, The Chinese University of Hong Kong, Shenzhen, China +1

Oct 12, 2026J/K move · Enter open · S save

Adversarial Robustness of Camera-Radar Sensor Fusion for Autonomous Driving

Ce Zhou, Yubo Wu, Khang Nguyen, Liyang Xiao+2

Missouri University of Science and Technology, USA · Virginia Tech, USA · Michigan State University, USA

Camera-Radar Fusion Adversarial Robustness Autonomous Driving Perception 3D Object Detection Depth Estimation

Open paper AskPDF arXiv

Autonomous driving (AD) relies on multi-sensor perception to interpret the surrounding environment. However, the robustness of camera--radar fusion under adversarial conditions remains largely unexplored. This paper presents a systematic measurement study of the robustness of camera--radar sensor fusion in AD. We construct a unified evaluation pipeline on the nuScenes dataset that simulates attacks on both sensing modalities, including eight camera-image perturbations and three radar point-cloud perturbations. We evaluate five camera--radar fusion algorithms across two perception tasks, 3D object detection and depth estimation, and quantify their performance under clean and attacked inputs using standard metrics. Our evaluation reveals a clear asymmetry in the robustness of fusion systems. Camera perturbations substantially degrade both object detection and depth estimation, and moderate attack strengths are already sufficient to cause severe performance degradation. In contrast, the evaluated radar perturbations produce smaller and task-dependent effects, with object-detection models showing particularly limited degradation. Our analysis attributes this difference to the strong dependence of existing fusion architectures on dense camera features, together with the filtering, association, and confidence-weighting mechanisms commonly applied to sparse radar measurements. These results demonstrate that sensor fusion does not inherently guarantee robustness and that the contribution and reliability of each sensing modality must be explicitly considered under adversarial conditions. Based on four empirical findings, we derive measurement-guided design implications for future robust camera--radar fusion, including modality-specific reliability estimation, cross-modal consistency checking, adaptive fusion, and graceful failover under severe sensor degradation.

Abstract

Autonomous Driving

Explore similar work

Adversarial Robustness of Camera-Radar Sensor Fusion for Autonomous Driving

A Reliable Context-Aware and Temporal Planning Framework for Autonomous Driving

Provisioning Robust and Efficient LiDAR Perception for Autonomous Driving